Methods for administering and taking a test employing secure testing biometric techniques

ABSTRACT

Methods for administering and taking a test using a headpiece supported on a person&#39;s head. A test is directed to the headpiece and includes real displays. A sequence of the real displays and fake displays are displayed on a display in front of the person&#39;s face. An encrypted code is provided, which when decrypted, provides places of the real displays in the display sequence. The encrypted code is decrypted to obtain the places of the real displays in the display sequence. A light valve assembly in the viewing portion is controlled to assume, when a real display is being displayed, a first state in which the person is able to view the display through the light valve assembly and thus the real display and assume, when a fake display is being displayed, a second state in which the person is prevented from viewing the display through the light valve assembly.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.15/467,733 filed Mar. 23, 2017, now U.S. Pat. No. 10,540,907, which is acontinuation-in-part of U.S. patent application Ser. No. 14/448,598filed Jul. 31, 2014, now abandoned, and which is a continuation-in-partof U.S. patent application Ser. No. 15/329,243 filed Jan. 25, 2017, nowU.S. Pat. No. 9,959,777, which is a National Stage filing ofInternational Application No. PCT/US15/45846 filed Aug. 19, 2015, nowexpired, which claims the benefit of U.S. provisional patent applicationSer. No. 62/040,806 filed Aug. 22, 2014, all of which are incorporatedby reference herein.

FIELD OF THE INVENTION

The present disclosure relates to the field of a computer-based systemand method for taking a test while ensuring that the test-taker is notreceiving assistance from another person while taking the test andoptionally ensuring that the device being used for viewing or taking thetest has not been and is not being tampered with or otherwisecompromised. Additionally, the present invention relates to the field ofglasses which permit the test-taker to view specific content on acomputer display which is not viewable by others without specialglasses. Nevertheless, the glasses are not limited to test-taking andcan be used for selective viewing applications.

BACKGROUND OF THE INVENTION

There has been a great deal of discussion in the press over the pastseveral years relating to MOOCs, Massive Open Online Courses. Using theInternet and readily available textbooks, education can be cheaplydistributed to anyone who has Internet access. It is now generallyrecognized that mastery of almost any field taught in colleges anduniversities can be achieved by a motivated student without attendinglectures at that college or university. Thus, the technology is in placefor any student to obtain knowledge that has previously only beenavailable to a campus-resident, matriculated student at a college,university or other institution at virtually no cost other than the costof textbooks.

In contrast, the cost of a traditional Massachusetts Institute ofTechnology (MIT) education, for example, resulting in a bachelor'sdegree can greatly exceed one hundred thousand dollars. The onlyimpediment which exists from preventing a university such as MIT fromgranting a degree to such a student is that the university needs to knowwith absolute certainty that the student did not cheat when taking thevarious exams required to demonstrate mastery of the coursework. With adegree from MIT, for example, industry will hire such a person at astarting salary approaching or exceeding $100,000 per year. Thus, thevalue to the student is enormous. Since the information which must bemastered is now available in readily available textbooks and for freethrough MOOCs on the Internet, the only impediment separating amotivated student from a high starting salary is that a degree-grantinguniversity must be certain that the student has demonstrated mastery ofthe material through successful completion of examinations.

As generally used herein, a “test” is any type of question-basedapplication that requires analysis by a person taking the test and aresponse from this person. A test may therefore be considered anexamination, a quiz, an assessment, an evaluation, a trial and/or ananalysis.

SUMMARY OF THE INVENTION

The present disclosure is directed partly at solving the problem ofguaranteeing, with a high degree of certainty, that a student taking atest is acting alone without the aid of a consultant or otherwisecheating. One technique to achieve this is to use a headpiece with abiometric identification feature.

A headpiece used in the invention includes a frame having supportstructure for supporting the frame on a person's head and a viewingportion configured to be in front of the person's face when the frame issupported on the person's head, and at least one light valve assemblyarranged in the viewing portion. Each light valve assembly has a firststate in which the person is able to see therethrough when the frame issupported on their head and an alternative second state in which viewingthrough the light valve assembly is prevented. A biometricidentification system is arranged on the frame and periodically obtainsbiometric data about the person. A controller or processor, generallyreferred to as a processing unit, is coupled to each light valveassembly and the biometric identification system and controls whethereach light valve assembly is in the first state or the second statebased in part on analysis of the biometric data obtained by thebiometric identification system to thereby control viewing through eachlight valve assembly.

In one embodiment, each light valve assembly allows light transmissiontherethrough only in a limited angular range to enable the person to seethrough the light valve assembly when the frame is supported on theperson's head and to prevent viewing through the light valve assembly bya person other than the person on which the frame is supported when theframe is supported on the person's head. The light valve assembly may besituated rearward of part of the viewing portion. The support structureincludes a nosepiece configured to support the frame on a nose of theperson. The viewing portion has a first viewing portion on one side ofthe nosepiece and a second viewing portion on an opposite side of thenosepiece. There is one light valve assembly in the first viewingportion and another in the second viewing portion. Each light valveassembly may include concentric cylinders spaced apart from one anothera distance to provide the angular range of, for example, 30 degreescentered about an axis passing through a central axis of the concentriccylinders.

A biometric scan camera, as one type of biometric identification system,obtains images of an area around an eye of the person on which the frameis supported. More particularly, an iris or retinal scan camera, asanother form of a biometric identification system, may obtain images ofan iris or retina of an eye of the person on which the frame issupported. A change in biometric data during a test is considered asevidence of cheating on the test.

One aspect is to prevent access to a device which the student is usingto take a test. A method for detecting an attempt to physically alter anelectronic device in accordance with the invention is a type of chassisintrusion detector. In the method, the device, such as glasses used forviewing the test during test-taking, is enclosed in a thin filmcontaining conductive wires which are positioned to surround the device(i.e., not part of the internal wiring of the device). Impedance of thewires is monitored by means of a security assembly (e.g., resistanceand/or mutual inductance between a pair of wires). When a change inimpedance is detected by the security assembly, a required security codeneeded for use of the device is deleted. In a preferred embodiment, thedevice is a glasses assembly being used for test-taking and thus withthe method incorporated into the device, secure test taking is provided.

The security assembly includes a processor, a power source for providingpower to the processor and a RAM assembly containing a required securitycode for use of the device for test-taking purposes. The securityassembly is configured such that any attempt to disassemble the securityassembly will break one or more wires connecting the power source to theprocessor and such that a change in impedance relative to a thresholdwill cause the security code to be erased from the RAM assembly. Thesecurity assembly may be coupled to the device using a port of thedevice. Apertures are provided in the envelope defined by the films inwhich the device is placed, the apertures having a size and locationallowing for power and information to be transmitted to the device. Thefilms are preferably transparent at portions that overlie a display ofthe device.

Another aspect of the invention is a method for limiting viewing ofcontent on a display, e.g., a test which constitutes a series of testquestions displayed on the display, using the viewing device asdescribed above including or incorporating the light valveassembly(ies). A display presents a test to the person when the frame issupported on the person's head, at least one user interface receivesinput from the person when the frame is supported on the person's headto start and proceed through the questions, and a processor is coupledto each user interface, the display and each light valve assembly andcontrols content of the display based on input received via the userinterface(s) and controls whether each light valve assembly is in thefirst state or the second state dependent on content of the display, Orvice versa, to thereby control viewing through each light valveassembly.

BRIEF DESCRIPTION OF THE DRAWINGS

The following drawings are illustrative of embodiments of the systemdeveloped or adapted using the teachings of at least one of theembodiments disclosed herein and are not meant to limit the scope of thedisclosure as encompassed by the claims.

FIG. 1A is a perspective view of a head worn glasses type devicecontaining an electronics assembly with several sensors, cameras andlenses all protected with a chassis intrusion detector prepared usingthe teachings of this disclosure.

FIG. 1B is a perspective view of the apparatus of FIG. 1A seen from therear.

FIG. 2 is a detailed drawing of the LCD or other light-valve baseddisplay section of the apparatus shown in FIG. 1A which includes a fieldof view controller.

FIG. 2A is a view of a section removed from FIG. 2.

FIG. 2B illustrates the field of view control mechanism.

FIG. 3 illustrates the combination of the glasses and a computer systemwhich can be a laptop, desktop, tablet, smartphone or other computingdevice.

FIG. 4 is a view of the chassis intrusion detector CID apparatuscovering the apparatus of FIG. 1A.

FIG. 5 is a schematic of the operation of the chassis intrusion detectorin accordance with the invention.

FIG. 6 illustrates the use of the apparatus in accordance with theinvention by a room full of test-takers where each device is attached toa central computer through a USB port.

FIG. 7 is a view like FIG. 6 with a wireless connection through awireless transmitter box associated with each desk and where thetest-takers are using paper to record their test answers.

FIG. 8 is a flowchart illustrating a startup, running, and shut down ofthe test taking process in accordance with the invention.

FIG. 9 is a flowchart illustrating a startup, running, and shut down ofthe test taking process.

FIG. 10 illustrates a flowchart for the encryption scheme utilized toprevent access to the test by other computers or devices then thedesignated computer.

FIG. 11 is a pattern recognition flowchart using neural networks foridentifying the test taker.

DETAILED DESCRIPTION OF THE INVENTION

For a general background of this invention, see WO2016028864 Securetesting device, system and method, which is incorporated herein byreference in its entirety.

Referring now to FIGS. 1A and 1B, this embodiment does not require aspecial laptop or other special computer to facilitate securetest-taking. Rather, in this embodiment, the test-taker can use adesktop or laptop computer, smartphone, tablet or other non-specializedcomputing device which is compatible with the teaching institution'ssystems. However, other components are required including a head-mountedapparatus or viewing glasses.

FIG. 1A illustrates one implementation of the invention, shown generallyat 10, which includes view control glasses 12. The view control glasses12 comprise a viewable window or light valve assembly 14 which is partof one or both glasses lenses, i.e., viewing portions present on eitherside of a nosepiece that may be made of a transparent material such asglass or a suitable plastic. The light valve assembly 14 controlstransmission of light through the lenses, a transparent glass or plasticelement of the viewing portion, to the eyes of the test-taker. Lightvalve assembly 14 can comprise an OLED, LCD, Pockels, Kerr cell or otherlight valve technology. Its purpose is to alternately allow light to betransmitted to the eyes of the test-taker when the glasses 12 aresupported on their head and the nosepiece on their nose, or to block itas described below.

A controller or processor 40 controls the light valve assemblies 14 toalternatively allow light passage or prevent light passage, but notprovide both at the same time. The light valve assemblies 14 thus have afirst light-transmitting state and a second light-blocking orlight-blanking state, and switch or change between states based oncontrol by the controller. When used with a display for test-taking, thecontent of the display (120, see FIG. 3) is correlated to the state ofthe light valve assemblies 14 so that the person wearing the glasses 12is able to see test questions destined for their viewing while othercontent not destined for their viewing is blocked from them.

To assure that the test-taking student is not receiving assistance froma consultant, it has been disclosed in other patent applications of thecurrent assignee, that the consultant must not know the contents of thetest questions since there is an unlimited number of methods where,having learned a question, the consultant can communicate answers to thetest-taker. Thus, to prevent cheating, the consultant must be deniedaccess to the questions. One method of achieving this goal and to stillallow use of a general viewable display is to scramble the contents ofthe display and then to provide a filter on a set of glasses worn by thestudent which unscrambles the content allowing only the student to seethe test questions. One method of accomplishing the goal is to create asequence of very similar displays where the real one is displayed in amixture of fake displays. A viewer capturing the sequence of displayscannot distinguish the real one from others in the series. However, anencrypted code as to the places in the sequence that the “real” displaycontent appears (that destined or intended to be viewed by thetest-taker) can be sent to the student's glasses where it is decryptedand used to control the light valve assembly 14, allowing onlytransmission of the real test question to pass to the student's eyes.Even if the real test only occurs on 5% of the scenes, the student willbe able to read the test whereas other viewers will be denied a coherentview. The sequence may be a number of a frame within a set of framesthat correlate to the real test question. For example, the display maydisplay the real test question at the fifth frame within each tenframes, and thus the sequence would be, 5, 15, 25, 35, etc. A randomnumber of the frame within a fixed number of frames is more ideal.

A device constructed in accordance with the teachings of this inventionis illustrated in FIG. 1A which is a perspective view of a head-wornglasses type device, referred to as test glasses, containing anelectronics assembly with several sensors, cameras and field of view(FOV) controlled lenses are all protected with a chassis intrusiondetector (CID) prepared using the teachings herein. A head-worn glassesand electronics device constructed in accordance with the invention isshown generally at 10 in FIG. 1A.

Test glasses device 10 comprise a frame 22 having two temples 16configured to be supported on the wearer's ears and a nosepiece 18configured to be supported on the wearer's nose, and a housing 20 thatextends from the frame 22. Housing 20 is substantially C-shaped withfirst portions 20A extending straight outward from an edge of the frame22 and a second, middle portion 20B perpendicular to the first portions20A and positioned extending behind the frame 22.

Either one or both eyes, as shown, can be allowed for the test-taker toview the display and the selected test questions through the light valvecontrolled lenses, i.e., through light valve assembly 14.

A forward viewing camera 26, representative of an imaging device, isalso arranged on or in the housing 20, i.e., the second portion 20B onthe right as shown in FIG. 1A, and monitors the field of view of thetest-taker outward from the device 10. Alternatively or additionally, aforward viewing camera 26 can be provided on the second portion of thehousing 20 on the left. The camera 26 can have a field of view ofapproximately 120°. Sound-detecting sensors, e.g., a pair of microphones28 and 29, are also arranged on or in housing 20, one on each secondportion, and monitor talking or other sounds which can take place whilethe test is in progress and the device 10 is on the head of thetest-taker. Two, or more, microphones 28 and 29 are provided so that thelocation of the sound source in a vertical plane can be determined byprocessor 40. No sound is permitted to be emanating from the mouth ofthe test-taker which could indicate an attempt of the test-taker tocommunicate information about a test question to a consultant. Iftalking by the test-taker is detected by microphones 28 and 29, displayof the test can be stopped by processor 40 and an indication of failureof the test generated by processor 40. More generally, at least oneaction is taken when cheating is detected, either by improper sounddetection or other improper action, and this action may includeassociating an indication of invalidity to the test being displayedand/or with the test-taker, and activating a notification systemproviding an indication that the person on which the frame 22 issupported is cheating on the test being displayed.

In some implementations, a third microphone, not shown, may beimplemented so that the exact location of a sound source can bedetermined by processor 40. A sound maker/generator or speaker 30 isarranged on or in the frame 22 or housing 20 and periodically provides asound detectable by the microphones 28 and 29 to enable verification byprocessor 40 that the microphones 28, 29 have not somehow been renderedinoperable. The manner in which this is done is known to those skilledin the art and disclosed in earlier applications to the inventor andcurrent assignee.

Each of these components 14, 26, 28, 29 and 30 is connected to aprocessor-containing electronics package (including processor 40) inhousing 20 which is mounted to the frame 22 in a manner known to thoseskilled in the art to which this invention pertains. A cable 24 emanatesfrom the electronics package in housing 20 and can contain a USBconnector 32 for connecting onto an external device such as a computer(see FIG. 1A).

An iris or retinal scan camera 34 is arranged on housing 20, pointinginward toward the wearer preferably from a location above one of thelight valve assemblies 14 as shown in FIG. 1B, and measures facialbiometrics of the test-taker. Such biometrics can include an iris orretinal scan or a scan of the portion of the face surrounding the eye,but are not so limited. As such, scan camera 34 should be considered asa biometric scan camera capable of scanning various at least onebiometric feature of the test-taker. Illumination of the eye can beprovided by LEDs 38 arranged on the housing 20 and/or frame 22, possiblyat a location above the light valve assembly 14 alongside the biometricscan camera 34, which can be in the IR or visible portions of theelectromagnetic spectrum. Two or more different levels of visibleillumination can be provided by LEDs 38 to cause the iris to be seen atdifferent openings to check for an artificial iris painted onto acontact lens. The scan camera 34 and LEDs 38 are shown arranged on theleft housing portion (see FIG. 1A) but could alternately be placed onthe right portion or on both portions. The scan camera 34 and LEDs 38are also connected to the processor-containing electronics package inhousing 20 by a wire or wirelessly.

The FOV device prevents a camera which may be mounted to the face of thetest-taker, or other location, from capturing the image on the display(on which the test is being displayed in front of the person wearing thedevice 10) through the light valve assemblies 14.

Software and a processor which controls administration of tests isresident on the external computer, in the electronics package in housing20, and/or in another device, not shown, which attaches to the device 10through connector 32 (or partly in multiple ones of these components). Atest-taker will have access to one or more user interfaces, for example,a keyboard and/or a mouse, for interacting with this computer, not shown(but shown in FIG. 3 described below). Using a keyboard, the test-takercan initiate the test-taking process through communication with thetest-provider. When the test is ready for execution by the test-taker,an encrypted version of the test's display sequence code is transmittedto the computer and relayed to the device 10. The electronics package inhousing 20, e.g., including the processor 40, utilizes a privatedecryption key to decrypt the image sequence of the test questions andcause them to be appropriately viewable on a display in front of theperson wearing the device 10 through the light valve assembly 14. Thelight valve assembly 14 is thus controlled dependent on the content ofthe display, and vice versa, to enable viewing of the test questions bythe test-taker and only by the test-taker since the same image sequenceof test questions would be needed to view the same test questions as thetest-taker. The test-taker then enters the answers to the questionsusing the keyboard and the computer display.

The test is preferably configured such that the answers do not provideinformation relative to the question. Therefore, someone viewing theanswers cannot discern therefrom the questions. As such, the questionanswers do not need to be encrypted, but can be sent in an unencryptedform to the test-providing institution or other test result analysisentity.

For example, if the test-providing institution is providing tests to1000 test-takers either simultaneously or at different times, and if thetest is of a multiple-choice type and contains 50 questions, the orderof the questions can be different for each test provided. Since thisprovides a very large number of different tests, each containing thesame questions, there is little risk that answers from one set ofquestions can be of any value to a test-taker taking a different orderedset of the same questions.

The entire electronics package, the light valve and FOV control devicesof the device 10 are encapsulated in a thin film called a chassisintrusion detection film. This film can comprise two conductive layersseparated by thin layers of plastic. The electronics package in housing20 can contain a processor or structure providing processing capabilityfor measuring the capacitance between the two conductive layers. If thiscapacitance is changed, as might happen if someone attempts to breakinto the electronics package, then the event can be detected through achange in this property. Alternatively, an array of wires can be printedonto a plastic film either before or after it has encapsulated theelectronics package in housing 20 in such a manner that any attempt tobreak into the housing 20 will sever or otherwise disrupt one or more ofthe wires. The wires can be made from indium tin oxide and thus betransparent. The wires can be thin, such as about 0.005 inches wide, andhave a similar spacing.

The private key for decoding the test question sequence, and any othercommands sent by the test-providing institution, can be held in volatileRAM memory in, for example, housing 20 which is kept alive through anextended life (10 years) battery which also can be recharged when thedevice 10 is connected to the host computer through connector 32. If thechassis intrusion detector system detects an attempt to break in to thedevice 10 or specifically housing 20, then the power to the RAM memorywill be shut off and the private key permanently lost.

When the test-taker is preparing to take a test, he or she will placethe device 10 onto his or her head. When this happens for the firsttime, attributes of the retinal, iris or other biometric scan viabiometric scan camera 34 will be recorded in memory in housing 20 forlater comparison. When this is accomplished, a signal can be sent to thecomputer or processor 40 indicating that the test-taker is ready to takethe examination. When the test-taker later takes a second test, a newbiometric scan will be conducted using biometric scan camera 34 toascertain that this is the same person who originally registered usingthis device 10. If this scan comparison, e.g., performed using theprocessor 40 in electronics package in housing 20, is successful, thenthe display and light valve assembly 14 will be activated and a signalcan be generated and/or sent by the processor 40 to the test-providervia the external computer to forward the encrypted test.

One or more heartbeat monitors 42 can also be added as a furtherbiometric check on the identity of the test-taker. Shape of a person'sheartbeat, if analyzed properly, can be used as another biometricidentifier.

An alternate biometric uses the test-taker's fingerprint for the initialsign on to the test taking process. This design can make use of thetablet rear camera, or other camera or fingerprint sensor attached tothe computer, and the test-taker places his or her finger at a directedposition and the finger is photographed or the fingerprint is otherwiseobtained through one of the many methods known in the industry. Thistheoretically could also be fooled by the use of a picture so the fingercan be monitored over a few seconds to determine that a pulse is presentusing methods such as amplifying the motion or the color of the fingeras disclosed in: “Software Detects Motion that the Human Eye Can't See”,Conor Myhrvold, MIT Technology Review, Jul. 24, 2012; “Seeing the humanpulse”, Larry Hardesty, MIT News Office, Jun. 19, 2013; and, “GuhaBalakrishnan, Fredo Durand, John Guttag, Detecting Pulse from HeadMotions in Video, presented at the IEEE Computer Vision and PatternRecognition conference, 2013. More of the finger print informationincluding the presence of a heartbeat and even the shape of theheartbeat can be captured by this method making it more accurate anddifficult to fool than conventional fingerprint scanners.

For this feature, the fingerprint sensor is attached to the computerhaving the display displaying the test, or may even be provide on theframe 22 or housing 20, and the test-taker is directed to put theirfinger onto the sensor. The pulse of the test-taker is measured in orderto determine that the finger is part of a living human. At the sametime, the fingerprint is analyzed for biometric security purposes. Thus,the processor 40 may be configured to interact with the fingerprintsensor to simultaneously perform biometric analysis and a live personverification via the same fingerprint sensor. It is possible to take thefingerprint for analysis to confirm the identity of the test-taker andverify that the source of the fingerprints is a live person at the sametime using the same device.

The scan camera 34 is controlled by the processor-containing electronicspackage in housing 20 to periodically check to ascertain that thetest-taker's iris is present and that it has not changed. If anythinganomalous occurs, such as the absence of an iris or the change of aniris, then the light valve assembly 14 will be deactivated by theprocessor 40. Thus, when the test-taker removes the device 10, the lightvalve assembly 14 will automatically stop filtering the test questions.Similarly, if the test-taker transfers the device 10 to another personwhose iris does not match that of the test-taker, then the light valveassembly 14 will not allow the test questions to be viewed therethrough(it will block or blank viewing). Above and in what follows, the iriswill be used to represent any of the aforementioned biometric scans. Thecomputer is directed to stop the test and indicate possible cheating andfailure of the test on the display, and possibly convey this indicationvia a communications system incorporated into the computer to thetest-providing institution or a test-monitoring facility. A reactivesystem is therefore provided in the computer coordinating the test toreact to an indication of possible cheating.

When the test-taker has completed the test questions, he or she willindicate such through the computer keyboard and the light valve assembly14 will no longer filter the test questions. The remainder of theinteraction with the test-providing facility will then occur through thekeyboard and/or mouse and the external computer.

The forward-looking camera 26 can have a field of view of 120°. Thisfield of view (FOV) will cover the hands of the test-taker to check forthe case where the test-taker is typing in the questions on a keyboard,other than the keyboard associated with the test, where they aretransmitted to a consultant. If the hands of the test-taker cannot beseen by camera 26, the light valve assembly 14 will be turned off untilthe hands can be seen. If this happens frequently, then the test can beterminated. Camera 26 can also be used to check for the existence ofother devices near the test-taker. These devices may include anothercomputing device such as a tablet computer, a smart phone, smart watch,books or papers, displays other than the test answers on the externalcomputer display, or any other information source which is not permittedfor the test. If the test is an open book tests, then searching of someof the above-listed objects can be permitted. Software whichaccomplishes these pattern recognition tasks can utilize one or moretrained neural networks or other AI software.

A limited number of encrypted commands which relate to the test beingadministered can be transmitted with the encrypted test from thetest-providing institution. These commands control some aspects of thetest taking process such as whether it is an open book or closed bookexamination, whether it is a timed test, how many restarts arepermitted, how many pauses are permitted etc., since the test process iscontrolled by the device 10, these commands will be decrypted and usedto guide the test taking process by the device 10.

Generally, there should be no talking while test taking is in progress.Microphones 28 and 29 are used to detect audio sounds and spoken words.If such sounds are detected particularly emanating from the test-taker,then the test can be paused or terminated depending on thetest-providing institution's requirements. Information as to what theresponse required of device 10 for this or any other anomaly can be sentin encrypted form from the test-providing institution. To preventspoofing of these commands, when the device 10 detects an anomaly, itcan transmit a request for action to the test-providing institution viathe host computer. The test-providing institution can respond withencrypted instructions as to what action to take.

The encrypted instruction can include a rolling code such that messagesrequiring the same result from the device 10 will not be identical andthus not able to be spoofed. To prevent the microphones 28, 29 frombeing covered with sound absorbing material, the speaker or soundgenerator 30 is provided to periodically create a sound which is thendetected by the microphones 28, 29 and the quality of the detectedsignal can be ascertained. If the microphones 28, 29 cannot clearly hearthe sound produced by the speaker 30, then the tests can be terminateduntil the issue is resolved. Speaker 30 may be placed at an alternatelocation on the housing 20 or frame 22 of to minimize direct sonicconduction through the structure.

FIG. 1B is a perspective view of the apparatus of FIG. 1A looking fromthe rear.

The processing unit includes a connection port to enable 24 a cable toextend from the processing unit in housing 20 to the computer being usedfor test-taking. This cable 24 may be the only connection between theprocessing unit in the housing 20 and the test-taking computer.

More importantly, for the reasons described above, to guarantee that thebiometric measurements have not been compromised, at least one of themeasurements should be accomplished on a secure device which isprotected by a chassis intrusion detector (CID) device, as describedbelow, and which contains the private key. Since the private key shouldbe adjacent to the display view controller which is on the glasses, thebiometrics measurement system also should be housed on the glasses. If acamera is mounted on the glasses so that it has a clear view of one ofthe test-taker's eyes, then an iris scan can be readily accomplished.Since the iris scan is among the most reliable of the biometricmeasurements, this may be sufficient. If a second biometric measurementis desired, then the same or different camera can perform a retinal scanor a scan of the blood vein pattern around the eye. This eliminates theneed for this hardware to be part of the computer. Now, any computer canbe used by the test-taker for test taking. The test image sequence isdecrypted just as it enters the glasses and the display of theappropriate views can only be seen by the test-taker. The private keyand test-taker's biometrics are stored in a CID-protected assembly onthe glasses frame adjacent to the display. Microphones are provided todetect any talking by the test-taker and a sound creator to test themicrophones.

Two problems remain which will be addressed below. A field of viewlimiter can be mounted on the display controller so that only thetest-taker can observe the display. If the tablet display is not seen bya consultant, then this can be a secure system. Finally, a biometricscan camera 34 capable of detecting and analyzing an iris scan (and/orfacial vein pattern or retinal) to provide a biometric analysis toconfirm the identity of the test-taker is also included.

Eye tracking is available to control the test-taker's peripheral visionand gesture input can be an option for answering questions on the testbeing taken.

FIG. 2 illustrates a detailed illustration of the view control lens,light valve assembly 14, incorporating a field-of-view (FOV) controlcover to limit the projection of the test to an area outside of thetest-taker's eyes where a camera designed to capture the test may belocated. FIG. 2 illustrates the device (glasses) 10 worn by thetest-taker with the light valve assembly 14 containing the FOV limiter36 allowing the test-taker only to see the test questions. FIG. 2A is asectioned view of FIG. 2 taken along the line 2A-2A of FIG. 2 and FIG.2B is an expanded view of the FOV limiter as seen in circle 2B in FIG.2A. Generally, the light valve assembly 14 allows light transmissiontherethrough in a limited angular range to enable the person to seetherethrough, e.g., view the test questions on a display in front of thedevice 10 (see FIGS. 3, 6 and 7), when the frame 22 is supported on theperson's head and to prevent viewing therethrough (e.g., of the testquestions on the display in front of the device 10) by a person otherthan the person on which the frame 22 is supported when the frame 22 issupported on the person's head. The limited angular range is coordinatedto the location of the wearer's eyes when the frame 22 is supported ontheir head.

The FOV limiter is comprised of a series of concentric cylinders 52which are spaced apart to block light passing through the light valveassembly 14 at angles greater than an angle which approximately coversthe eye of the test-taker. The walls of the cylinders 52 block lightfrom being seen at angles greater than, for example, +/−15 degrees whichis just sufficient to cover the eyeball of the test-taker (the person onwhich the device 10 is secured). The limited angular range in thisembodiment is therefore about 30 degrees centered about an axis passingthrough a central axis of the concentric cylinders 52.

The walls of the cylinders 52 can be about 0.5 mm thick and the spacingbetween the walls about 0.27 mm. These dimensions depend on the spacingof the FOV limiter 36 from the test-taker's eyes. Thus, a hidden camerawhich is not on or closely adjacent to the test-taker's eyeball will notbe able to see the display through the light valve assembly 14. If sucha camera were placed over the test-taker's eyeball, for example, itwould be seen by the iris camera and the test can be terminated or otherreactive step undertaken. The iris camera is designed to monitor thearea where the FOV limiter 36 allows the display to be seen. As seen inFIG. 2B, the cylinders 52 are behind a transparent glass or plastic thatis part of the viewing portion.

The operation of the light valve assembly 14 will now be explained withreference to FIG. 3 which illustrates the combination of the glasses(device 10) and a computer system which can be a laptop, desktop,tablet, smartphone or other computing device.

Without the light valve assembly 14, a determined cheater has a routeopen for getting the assistance of a consultant. Since the display ofcomputer 120 can be observed optically, a consultant may position acamera with a telephoto lens somewhere in the room or on or through awall that can view the display of the computer 120. Alternatively, thetest-taker may wear a hidden camera, which is not observable by eitherthe iris camera or a camera on the external computer, which can monitorthe tablet display. Such a camera, for example, may be worn around theneck of the test-taker and view the screen through a very small openingin the shirt or blouse worn by the test-taker and be very difficult tosee by a camera mounted on or near the computer display, for example.These two types of cameras, through-the-wall and test-taker-mounted, canbe disguised in such a manner that it is virtually impossible for thesystem monitoring cameras, if present, to detect their presence.Nevertheless, either of these cameras can transmit the contents of thecomputer screen to a consultant in another room, for example. A solutionto this problem rests in scrambling the display of the computer 120 andproviding the test-taker with a special pair of glasses whichdescrambles the display using a light valve assembly such as 14. Manytechniques are available for accomplishing this task and one will now beexplained. Modern displays refresh the screen at 240 Hz. Since the texton a test changes very slowly only a small portion of this informationneeds to be seen by the test-taker. For example, if the screen displaysconstantly changing images which are very similar to the text on thetest wherein only 5%, for example, of the images represent the actualtest, then anyone observing the screen through one of the aforementionedcameras would see a blur of constantly changing text. If the test-takerwears a set of glasses, illustrated at 122 in FIG. 3, where the lensesare made opaque through liquid crystal or other light valve technology,then the lenses can be made transparent only during the 5% of the timethat the display of the computer 120 presents the actual test questions.Such glasses are similar to commercially available consumer productswhich are used for 3-D television viewing. For an example of suchglasses see http://www.dimensionaloptics.com/Panasonic.aspx. Theparticular display frames that contain the actual test questions can berandomized and the random code indicating which frames are to be seencan be sent to the glasses control module in an encrypted form, alsoprotected with a CID system, such that only the glasses 122 worn by thetest-taker know which frames to pass through the light valve assembly 14to be able to be viewed by the test-taker.

If the hidden camera image capture apparatus used by the consultant issufficiently sophisticated, each frame could theoretically be capturedand thus the consultant could see all of the frames and if it wasobvious which frames contained the actual test questions, then theconsultant could discard all the irrelevant images. It is thereforeimportant that there be no obvious clue as to which images contain theactual test questions and remaining images must look very similar withonly slight differences.

FIG. 3 illustrates a view of a test-taker using the head worn apparatus122, as represented by 10 in FIG. 1A, interacting with a computingdevice represented by the computer 120. Although the touchscreen displayon the computer 120 could be used as a user interface, in this example akeyboard 126 and mouse 128 are provided as user interfaces to simplifythe test taking process. The apparatus 122 includes a forward lookingcamera 124 which is different from cameras used in Google Glass™, forexample, in that it provides a field of view that closely matches thatof the test-taker.

In particular, hands 130 of the test-taker can be monitored by thiscamera 124 to ascertain that the test-taker 110 is not communicatingwith the consultant through typed messages using the keyboard 126 or anyother device. Since the computer 120 used by the test-taker to provideanswers to the questions has not in any way been secured, it could beused as a method for the test-taker to communicate with a consultant.Similarly, other devices such as a smart phone or additional tabletcomputer, may be hidden by the test-taker and used to send the questionsto the consultant and receive communications back relating to theappropriate answers. Thus, the camera 124 and the associated patternrecognition software is an important aspect of this invention.

The pattern recognition software can be located within the electronicspackage associated with the apparatus 122, e.g., in a housing extendingfrom or integral with the frame, and can be based on a trained neuralnetwork. One key advantage of this approach is that as experience isgained with the system, the neural network can be readily retrained tocheck for various newly discovered cheating methods. The fact thatneural networks can be used in this fashion permits continuousimprovement of the apparatus 122.

There are other sensors including the iris imaging camera and two ormore microphones, that similarly provide data which contain patternswhich are appropriate for neural network analysis (disclosed above indevice 10 and which can be included in apparatus 122). In some cases,initially this analysis can be simplified by using the differencesbetween two images. For example, for the iris monitoring camera 34, itis expected that the image of this should be invariant and therefore anysignificant changes in that image would be indicative of an anomalywhich should be brought to the attention of the test-taker for remedialaction. Similarly, once the test has begun, there should be no voicessensed by the microphone 28, 29 and therefore if any voice frequenciesare present, especially emanating from the mouth of the test-taker, theanomaly can be highlighted for remedial action by the test-taker. Theiris image analysis can be somewhat more complicated, however, againsince it is the difference between two such images which is significant,the analysis can at least initially be relatively uncomplicated. Thedifference between two images of the same test-taker should berelatively minor whereas the difference between another person's irisimage and that of the test-taker can be quite complicated. This shouldbe easily detectable. In order to guard against the use of a contactlens with a painted surface showing an invariant iris image to a irisimaging camera, LEDs 38 as illustrated in FIG. 1B are provided to causethe iris to change its opening aperture due to more intense illuminationthereby giving two different images of the iris for verification. Againhowever, the analysis can be relatively simple where in the firstinstance, the iris which is imaged under the two different conditions isrecorded and thereafter, only image subtraction and relatively minoranalysis is required.

An objective of this test taking system is that it is completelyautomatic without requiring the intervention of any human other than thetest-taker 110. The institution administering the test will have alimited set of rules which, if violated, will render the test invalid.These rules can be general rules or rules specific to the particulartest being taken. These rules can include: the events which willinvalidate a test; the number of times that the test, once an event hasoccurred, can be restarted if any; the number of times that a particulartest can be taken if failed; the time permitted to take the test; thenumber and length of pauses permitted during the test taking process,etc. The rules may or may not be made available to the test-taker 110.

All of this puts a small burden on the institution to draw arbitrarylines as to what constitutes cheating and what does not. This is arelatively light burden with the test taking apparatus, since once therules have been set the opportunities for an undetected violation ofthese rules are very limited or virtually nonexistent.

A substantial number of sensors have been introduced, each of thesesensors requires an algorithm to assess the sensor output and determinewhether the test-taker is cheating or not. Since the apparatus 10, 122are provided with a chassis intrusion detector (CID), such as disclosedherein, it is virtually impossible for a consultant to modify theapparatus 10, 122 to transmit the display information to another room,for example. With a CID, there are no accessible wires which connect thedisplay to the electronics package, for example. Finally, the displaycontrol light valve itself is protected. The test-taker 110 can wear acamera which has a lens the size of a small pea but in order for thatcamera to see the display, it will also itself be seen by the irisimager camera 34.

Of course, if a cheating method is discovered, it will quickly becomepublic through the Internet. Therefore, a continuous improvement processwhich rewards test-takers who discover cheating methods should beimplemented.

At the discretion of the institution, a time limit or no time limit canbe afforded the test-taker 110 for completing the test. Similarly, acourse can have only a single final exam or a series of quizzes inaddition to a final exam or feedback can be requested from thetest-taker 110 during each course session depending on the course andthe desires of the institution. Since all such tests will be gradedautomatically, the cost of having daily or more frequent quizzes versusa single final exam is insignificant. In one extreme case, all therequired courses can be given without any exams and a finalcomprehensive exam can be used to validate a student for receiving adegree. Alternately, the student can be tested continuously during thecourse or degree process without any final examinations. These decisionsare left up to the institution. These options are facilitated due to theability of the student to observe instruction presented on the computerscreen, and through textbook assignments, and at arbitrary times betested using the apparatus 10, 122.

The test-taker can enter data into the testing program through thekeyboard 126, a track pad (not shown), and/or the mouse 128, or anyother type of user interface such as a touch screen of the computer 120.The mouse 128 can be attached to the computer 120 with a fixed wire orbe wirelessly connected to the computer 120.

Various biometric technologies for verifying the identity of thetest-taker for use with apparatus 10, 122 will now be discussed. Sincethe apparatus 10, 122 are mounted on the head in front of the eyes, themost readily available biometrics are images of the eyes or facialtissues surrounding the eyes. A variety of different biometric tests canbe devised, but the most common are retinal scans and iris scans. Bothare available using a camera mounted in conjunction with the apparatus10, 122. The retinal scan is used to examine the pattern of bloodvessels at the back of the eye. Although retinal patterns may be alteredin cases of diabetes, glaucoma or retinal degenerative disorders, theretina typically remains unchanged from birth until death. Due to itsunique and unchanging nature, the retina appears to be the most preciseand reliable biometric, aside from DNA. Advocates of retinal scanninghave concluded that it is so accurate that its error rate is estimatedto be only one in a million with appropriate software. The blood vesselswithin the retina absorb light more readily than the surrounding tissueand are easily identified with appropriate lighting. A retinal scan isperformed by casting an unperceived beam of low-energy infrared lightinto a person's eye as they look through the scanner's lens. This beamof light traces a standardized path on the retina. Because retinal bloodvessels are more absorbent of this light than the rest of the eye, theamount of reflection varies during the scan. The pattern of variationsis converted to computer code and stored in a database.

The iris scan is an automated method of biometric identification thatuses mathematical pattern-recognition techniques on video images of theirises of an individual's eyes, whose complex random patterns are uniqueand can be seen from some distance. Not to be confused with other, lessprevalent, ocular-based technologies, retina scanning and eye printing,iris recognition uses camera technology with subtle infraredillumination to acquire images of the detail-rich, intricate structuresof the iris externally visible at the front of the eye. Digitaltemplates encoded from these patterns by mathematical and statisticalalgorithms allow the identification of an individual. Many millions ofpersons in several countries around the world have been enrolled in irisrecognition systems, for convenience purposes such as passport-freeautomated border-crossings, and some national ID systems based on thistechnology are being deployed. A key advantage of iris recognition,besides its speed of matching and its extreme resistance to falsematches, is the stability of the iris as an internal, protected, yetexternally visible organ of the eye.

Both of these scans are extremely accurate and very difficult to fake.Since the apparatus for conducting these scans is protected by thechassis intrusion detector system, they are a preferred biometricidentification systems for use with this invention. Although it has beenproposed that secure testing systems utilize more than one biometricidentification, the accuracy of either of the retinal or iris scans isso high as to eliminate the need for a second biometric identificationsystem. The iris scan is somewhat easier to implement and therefore isthe preferred system for use with this invention. Nevertheless, tosatisfy the desire for dual biometrics, a heartbeat monitor 42 has beenoptionally provided as described above (see FIG. 1A).

Consideration is necessary concerning where the test-taker's biometricsare stored. If they are transmitted to the test-providing institution,then there is the risk that if they are not encrypted that thetransmission can be captured, allowing a consultant to log on as thetest-taker in the future. If they are encrypted at the laptop, then eventhe encrypted biometrics can be captured and used by the consultant. Asolution is for the institution to transmit an encrypted random numberto the laptop which combines that number with a code representing thesuccess or failure of a biometrics measurement and transmits acombination of the decrypted random number and the code back to theinstitution. For example, assume that the random number was 45896 and 1represents a biometrics failure and 0 a success. The laptop upon failureof the biometrics test would return 45897 to the institution and theinstitution would then not proceed with the test. Thus, if the privatekey is secure on the laptop, then only the laptop needs to know thetest-taker's biometrics which will be stored only locally and can bestored in a coded manner which makes spoofing by another systemdifficult or impossible. The preferred system and method, however, is tostore the private key and biometrics in the CID protected glasses.

One preferred method in implementing a chassis intrusion protection(CID) system in conjunction with the test-taking apparatus 10 isillustrated in FIG. 4 at 220. In this implementation, the glassesassembly is separated into three parts, the main assembly 210 to beprotected and two temples 212. The two temples 212 can contain theoptional heartbeat monitor illustrated at 42 on one or both temples 212.If the heartbeat monitor 42 is used, then there will need to be anelectrical connection, not shown, to the main assembly 210. Any suchconnections, including the connection to the computer though the wireand USB connector 32, will need to pass through the CID. The CID can bein the form of a thin film which is wrapped around the housing 20 andthen heated so that the film flows together and seals the housing 20leaving no openings. If further protection is desired, the entireassembly can be coated in another thin film which then binds the CIDtogether with the housing 20. Many other techniques will now suggestthemselves to those skilled in the art.

The CID 220 in this implementation comprises a very thin film containingone or more very thin closely spaced wires. These wires form a circuitwhich is monitored as illustrated in FIG. 5. The film and wires aresufficiently small that both light and sound can pass through withoutsignificant attenuation. However, if any of the wires are severed, aswould happen if any physical intrusion were attempted, such a severingis detected by the detection circuit of FIG. 5 and the stored biometricsand private decryption key can be erased rendering the glasses incapableof test taking.

A schematic of the operation of the chassis intrusion detector of FIG. 4is provided in FIG. 5 for the labyrinth circuit case. Since the chassisintrusion detector is designed to encompass the entire electronics andsensors assembly, it must be relatively thin so as not to interfere withthe microphones 28, 29 and speaker 30 and be transparent such as to notinterfere with the display or cameras. One method is to form a filmcomprising several layers. The first layer adjacent to the apparatuswould be a thin plastic film. Onto that layer is deposited a thin layerof a conductive material which can be indium tin oxide or graphene. Theformer is relatively available whereas the graphene is becoming more andmore available. After the conductive layer is deposited onto the firstplastic layer, a second thin plastic layer is deposited over theconductive layer and a second conductive layer is deposited onto thesecond plastic layer. Finally, the assembly is completed with thedepositing of a third plastic layer. Each of these layers is typicallybetween about 0.001 and about 0.010 inches thick and the total assemblyis transparent.

The chassis intrusion detector can contain its own microprocessorsecurity assembly 454 and battery 458. It also contains its own RAMmemory 456. The RAM memory 456 contains the private key which is keptalive by the battery 458. The battery 458 is chosen such that it canprovide sufficient power to maintain the RAM memory 456 active forseveral years and provide power to the microprocessor to monitor theconductive films. The conductive films are attached to themicroprocessor which checks for the capacitance between the two films.Any change in this capacitance detected by the microprocessor isindicative of an attempt to intrude into the interior of the electronicsand sensors assembly. If such intrusion is detected, then power isremoved from the RAM memory 456 and the private key pair erased.

Since a carefully placed hole or multiple holes through the plastic filmassembly can cause only a minor change in the capacitance as long as theconductive layers are not shorted together, a preferred alternativeconstruction, as illustrated in FIG. 4, is to replace the two conductivelayers and separating plastic film with a single layer comprising alabyrinth of wires which are very narrow and closely spaced such thatany attempt to penetrate the film will cause one or more of these wiresto be cut. The microprocessor therefore monitors the total resistance,inductance or mutual inductance of this circuit and erases the privatekey and other memory contents if there is a significant change in thesemeasurements. Since any attempt to break into the electronic and sensorassembly will necessarily sever one of these wires, this design providesan easily detectable method of determining an attempt to intrude intothe system electronics and sensor assembly.

A schematic of the chassis intrusion detector system is shown in FIG. 5generally at 450. Power is supplied from the external computer at 460through the wire and USB connector 32 of FIG. 4. Wire 460 also providescommunication from the electronics and sensors assembly of which thesecurity assembly SA is a part. The fine wire maze is shownschematically at 452, the security assembly (SA) at 454, the long-lifebattery at 458 and the RAM memory at 456. The security assembly (SA) 454can be a separate subassembly which is further protected by being pottedwith a material such that any attempt to obtain access to the wiresconnecting the battery to the microprocessor therein or to the RAMmemory 456 would be broken during such an attempt. This is a secondaryprecaution since penetration to the SA 454 should not be possiblewithout destroying the private key.

To summarize, any disruption of the wire mesh or conductive film ineither of the above described examples will destroy the private key, andother memory contents, making it impossible to decode the test questionsequence. After the assembly is completed, the computer can be poweredon and the first step would be to measure the inductance, resistance,and capacitance, as appropriate, of the mesh or films. Thereafter, ifany of these measurements significantly change, then the circuit in theSA 454 would remove power from the RAM memory 456 thereby destroying theprivate key and other memory contents. Since the private key cannot bereloaded, the assembly would need to be returned to the factory forremanufacture and the insertion of a new SA 454 or entire electronicsand sensors assembly.

The apparatus 10, 122 can be used by test-takers remotely located fromthe institution providing the test. Alternatively, as illustrated inFIG. 6, the apparatus 10, 122 can be used by a room full of test-takerswhere each device is attached to a central computer through, forexample, a USB port. In this case, each student 502 is provided with akeyboard and/or a mouse or other input device, and a display 504. Eachof the devices is connected to a central computer 506. Otherwise, theoperation of the apparatus 10, 122 is as described above.

FIG. 7 is a view similar to FIG. 6 where the answers are placed on apiece of paper which will be collected by the test proctor at theconclusion of the test. Again, since each test-taker will be taking thesame test with the questions randomly ordered or sequences, there is noadvantage in a test-taker surreptitiously communicating an answer toanother test-taker. Thus, by the arrangements depicted in FIGS. 6 and 7,the apparatus 10, 122 can be used either remotely or in a classroomenvironment.

An exemplifying, non-limiting system process flowchart is illustratedgenerally at 600 in FIG. 8.

-   -   1. The test-taker plugs the USB connector from the apparatus 10,        122 into the intermediary computer at step 602, puts on the        apparatus 10, 122 which recognizes that the test-taker's eye is        in view of the iris imaging camera.    -   2. The test-taker logs on to the Internet, or other computer        system, and communicates with the test-providing institution at        step 604. If this communication attempt is successful, then the        test-taker will be prompted to identify himself/herself which        may include his student identification code or number and        indicates that he/she is ready to take a test.    -   3. The test-taker is prompted to enter the identification of the        course for which he or she desires to take the test at step 606.        Software at the institution then determines the appropriate test        to be provided to the test-taker, for example, based on his or        her progress to date. The test-taker's biometrics can now be        verified at step 608.    -   4. The test-providing institution modifies the standard test to        be given to the test-takers by rearranging the questions in a        random order and associates that order with the test-taker's ID.    -   5. Once the appropriate test has been determined, it is        downloaded to the intermediary computer along with the encrypted        sequence code of display content relating to the test. The        encrypted sequence code is then forwarded to the apparatus 10,        122 for decryption and control of the light valve assembly at        step 610. The initial page of the test is then displayed on the        computer display and the test-taker indicates his or her        readiness to start the test at step 612.    -   6. The apparatus 10, 122 continue to perform iris scans or other        biometric identification scans throughout the test to verify        that the apparatus 10, 122 have not been removed (i.e., there is        no change in biometric data) and that the proper student is        taking the test. Initially, a message can be sent to the        test-providing institution via the intermediary computer        indicating that the device has successfully verified the        test-taker's biometrics if desired by the institution.    -   7. The apparatus 10, 122 performs an analysis from the forward        facing imager 26 to verify that the test requirements for the        environment are met and a pair of microphones 28, 29 functioning        test is performed by the speaker 30 admitting a sound to the        microphones which is analyzed to ascertain that it has been        properly received at step 614.    -   8. A display appears on the intermediary computer listing the        question numbers and providing a space for the answers.    -   9. If appropriate, the test timer is started at step 616 and the        test-taker proceeds to read the questions and answer them using        the keyboard and/or the mouse attached to the intermediary        computer.    -   10. The forward-looking camera 26 constantly monitors the field        of view of the test-taker to check for any violation of the test        rules.    -   11. The microphone also constantly monitors the sound near the        test-taker, and particularly from the test-taker's mouth, to        check for any verbal violation of the test rules.    -   12. The iris imaging camera constantly verifies that the iris        exists at its expected location indicating that the test-taker        continues to wear the apparatus 10, 122 (i.e., there is no        change in biometric data, and remains in the current state).    -   13. If the iris is not found or there are any other violations        of the test rules discovered, then the light valve terminates        filtering the display output (and provides its light-blocked or        blanked state, i.e., changes state).    -   14. Depending on the rules which were violated causing the        functioning of the light valve to terminate, remedial action is        undertaken as dictated by the test-providing institution.    -   15. Using the keyboard or mouse associated with the intermediary        computer, the test-taker indicates that he has completed taking        the test at step 618.    -   16. Upon completion, the test answers are forwarded to the        institution by the intermediary computer.

Special software is required for the external computer. This softwaremay vary depending on the operating system of that computer butgenerally will be provided by the test-providing institution. Thissoftware will manage the interface between the apparatus 10, 122 and thetest-providing institution. The software also will not permit anyinformation to be displayed on the screen while the test is underwayother than information related to the test. The forward monitoringcamera 26 will confirm that there is no unexpected information displayedon the computer screen and if so a fault will be indicated and the testterminated.

An exemplifying, non-limiting system process flowchart is illustratedgenerally at 200 in FIG. 9. At step 202, to begin a test using thetesting assembly or computer 120, the computer 120 attempts to log on tothe Internet and communicate with the test-providing institution. Ifthis communication attempt is successful, then the student will beprompted to identify himself which may include his studentidentification code or number at step 204. At step 206, the biometricsof the student is/are measured and checked to validate that this is thestudent whose record has been accessed at the institution. Suchbiometric identification codes may have been previously stored at theinstitution associated with the students ID as discussed herein. If thestudent is confirmed based on the measured biometrics, the student isprompted to enter the identification of the course for which he or shedesires to take the test at step 208. Software at the institution thendetermines the appropriate test to be provided to the student, forexample, based on his or her progress to date. Once the appropriate testhas been determined, it is downloaded and decrypted by the computer 120at step 210. The initial page of the test is then displayed on thedisplay of the computer 120 and the student indicates his or herreadiness to start the test at step 212.

The test timer is then started and a test in-progress light isilluminated at step 214. At step 216, the student takes the examination.When the student has completed the test, he or she indicates this by anappropriate computer keyboard entry and the test is completed. At thispoint, the answers can be encrypted, although they do not need to besince the answers do not display the questions, and transferred to theinstitution over the Internet and the test in-progress light is turnedoff.

FIG. 10 provides a flowchart for an encryption/decryption scheme showngenerally at 300 (corresponding to step 210 in FIG. 9). At step 302, thetest is downloaded by the testing assembly and at step 304, the privatekey is retrieved, typically from a memory in the computer 120 asdiscussed herein. At step 306, decryption using the stored private keyis accomplished and at step 308, a time stamped message is sent to thetesting institution indicating that this decryption was successful. Atstep 310, the test is displayed on the student's computer waiting for anindication from the student that he or she is ready to proceed.

To use the computer 120 in this manner, the chassis should be protectedwith a chassis intrusion detector with the private key stored in RAMvolatile memory with its own long life battery power supply as describedherein. If this is not the case, then the computer can be opened and thedisplay images transmitted off the computer, and if the private key isstored in nonvolatile memory, it can be retrieved and used by anothercomputer which is designed to spoof the computer. With the cost ofeducation approaching or exceeding $100,000, there is ample motivationto undertake these actions.

FIG. 11 illustrates a pattern recognition flowchart shown generally at400.

A properly trained general pattern recognition process can be used forany of the biometric data retrieved by the sensors of the testingassembly as listed above including facial recognition, voiceprint, palmprint, fingerprint, iris scan patterns, signature recognition, or any ofthe other pattern-based biometric identification systems describedherein. The biometric data is acquired at step 402 and input into thepattern recognition algorithm which can be a properly trained neuralnetwork at 404. If verified, this information is sent to theinstitution, as described above, which returns a code indicating that itis okay to proceed with the test taking process at step 406.Specifically, the institution compares the transmission received withthe sent random number and indicates whether the test taking is allowedto proceed, so that the test taking procedure proceeds at step 408.Alternately, the appropriate neural network check of the biometric testdata can be accomplished at the institution, in which case, the data istransferred to the institution. However, this adds significant risk tothe process as described above, so it is not recommended. If agreementbetween the stored biometric data and the newly acquired biometric datadoes not agree, then the trial count is incremented by one at 410. Ifthe trial count has not exceeded the maximum permitted as determined atstep 412, then the student is requested to initiate a re-acquisition ofthe biometric data and the process repeated. If the maximum number oftries is exceeded, then the test is not downloaded and the student islogged off of the session at step 414.

Some important features of disclosed inventions differentiate themsignificantly from other attempts to develop secure testing systems.These include:

-   -   1. Use of a head-mounted display light valve-based controller        for presenting randomized questions to the test-taker in a        manner that such questions cannot be obtained or observed by        another person. Such a controller can comprise a LCD, OLED,        Pockels cell, Kerr cell or other light valve which blanks out        the lens at times except when the proper test or test questions        is displayed on the computer display.    -   2. A field-of-view device can be provided to control the angle        which allows the test-taker to see the test so that only the        test-taker's eye can see the test.    -   3. The same test is given to multiple test-takers wherein the        order of the tests questions is randomized to prevent the        passing of answers from one test-taker to another. Each        test-taker will take the identical test but the questions are        ordered differently.    -   4. The test taking process is fully automatic and does not        require any human intervention. If the test-taker violates rules        of the test-providing institution, the particular violation will        be noted and provided to the test-taker and/or the institution.        The institution may only get involved if the test-taker protests        the results.    -   5. No data is transmitted in an encrypted form from the        apparatus 10, 122 to the test-providing institution. The        test-providing institution knows the test that was provided to        the test-taker based on his/her ID and therefore can match the        test answers with the questions.    -   6. No video or audio data is forwarded to the test-taking        institution. If the test was successfully complete, it is        assumed that no cheating occurred. If the test is interrupted,        then diagnostic information can be retained and upon request of        the institution forwarded thereto for diagnostic purposes. In        general, neither video nor audio information is stored during        the test-taking process unless the test is interrupted.    -   7. No behavioral measurements are made, recorded, or sent to the        institution and thus it is not necessary to try to interpret        cheating activity based on biometric or other measurements.    -   8. The test questions are only available to the display        controller which is part of the apparatus 10, 122 and protected        using strong encryption and by the chassis intrusion detecting        system.    -   9. Since it is virtually impossible for a consultant to observe        a copy of the test, attempts to determine that a consultant is        communicating with the test-taker other than oral communications        are unnecessary. Such communications from the consultant are        impossible to reliably detect.    -   10. The decryption private key is created as part of a key pair        by the test-providing institution and after loading into the        test glasses, the private key can be destroyed. Since then the        only copy that exists is on the test glasses and protected by        the chassis intrusion detector, no other device can decrypt the        test display sequence which has been created by the        test-providing institution uniquely for the particular apparatus        10, 122.    -   11. The use of a chassis intrusion detection (CID) sensor or        system which renders the physical breach of the apparatus        virtually impossible without destroying the private key needed        for test view sequence decryption.    -   12. The detection of sound emitted by the test-taker such that        anything sound emitted by the mouth of the test-taker can be        detected and the source located by the microphones.    -   13. The detection, for example, of a smart watch or other        similar apparatus used for cheating which can be hidden from        view of a tablet or other non-glasses mounted camera but can be        detected by the head mounted forward facing camera.    -   14. Use of sophisticated neural network based pattern        recognition algorithms which allow for continuous improvement of        this system as new cheating methods are discovered. This allows        for upgrading the software of the system as new improvements are        implemented.

The capability exists for adding the detection of suspicious behaviorson the part of the test taker.

-   -   15. Use of a scrambled display and light valve glasses to permit        the contents of the display to be only observed by the        test-taker and not capable of being captured in a meaningful way        by a camera having a view of the display.

Disclosed herein are a series of measures that are designed to preventthe transfer of test related information to anyone other than thetest-taker by any means either visually, electronically, or wirelessly.The measures disclosed herein are not exhaustive and the intent of thisinvention is to cover preferred implementations of such techniques.

Finally, all patents, patent application publications and non-patentmaterial identified above are incorporated by reference herein. Thefeatures disclosed in this material may be used in the invention to theextent possible.

The invention claimed is:
 1. A method for administering tests totest-takers, comprising: directing a respective one of the tests from asource of tests to each of a plurality of testing assemblies being usedby a respective one of the test-takers, each of the tests comprisingreal displays; displaying, on a display of each of the testingassemblies visible to the respective one of the test-takers, a sequenceof the real displays for the respective one of the tests and fakedisplays; directing, to each of the testing assemblies, an encryptedcode providing, when decrypted, places of the real displays in thesequence of the real displays for the respective one of the tests andfake displays; decrypting, at each of the testing assemblies, theencrypted code to obtain the places of the real displays in the sequenceof the real displays for the respective one of the tests and fakedisplays; controlling a light valve assembly in each of the testingassemblies interposed between the display and eyes of the test-takersbased on the obtained places of the real displays in the sequence of thereal displays for the respective one of the tests and fake displays tocause the light valve assembly to assume, when a real display is beingdisplayed, a first state in which the test-taker is able to view thedisplay through the light valve assembly and thus the real display andassume, when a fake display is being displayed, a second state in whichthe test-taker is prevented from viewing the display through the lightvalve assembly; and receiving responses from the test-takers to queriesin the displayed real displays via at least one respective userinterface associated with each of the testing assemblies; whereby byevaluating the received responses from each of the test-takers,associating the evaluations with the determined identity of thetest-takers, and grading the tests, a record of the test-takers withtheir grades is created.
 2. The method of claim 1, wherein the realdisplays comprise multiple-choice test questions, further comprising:generating the tests from a plurality of common multiple-choice testquestions; and changing the order of the multiple-choice test questionsin each test to create a plurality of different tests.
 3. The method ofclaim 1, further comprising encapsulating a housing that housesstructure that decrypts the encrypted code in a chassis intrusiondetector of each of the testing assemblies that detects intrusion intothe housing.
 4. The method of claim 1, further comprising: performing abiometric evaluation to determine an identity of each of the test-takersusing a biometric identification device of the respective one of theplurality of testing assemblies; obtaining biometric data of each of thetest-takers of the same type that is obtained by the biometricidentification device of the testing assemblies prior to administrationof an initial test; recording the obtained biometric data in a memorycomponent for each of the test-takers; and then generating a signalindicating that the test-taker is ready to take the initial test.
 5. Themethod of claim 4, wherein the step of performing the biometricevaluation to determine identity of each of the test-takers using thebiometric identification device comprises: obtaining biometric data ofeach of the test-takers using the biometric identification device at thelocation of each of the test-takers prior to administration of asubsequent test after the initial test; ascertaining, based on theobtained biometric data, whether the test-taker using each of thetesting assemblies when taking the initial test is the same as thetest-taker using the same testing assembly when taking the subsequenttest; and when it is ascertained that the test-taker using each of thetesting assemblies when taking the initial test is the same as thetest-taker using the same testing assembly when taking the subsequenttest, generating a signal indicating that the test-taker is ready totake the subsequent test to enable reception of the subsequent test bythe testing assembly.
 6. The method of claim 1, wherein each of theplurality of testing assemblies is positioned on a head of therespective one of the test-takers at a location of the respective one ofthe test-takers, the method further comprising: performing a biometricevaluation to determine an identity of each of the test-takers using abiometric identification device of a respective one of the plurality oftesting assemblies; wherein the step of performing the biometricevaluation to determine identity of each of the test-takers using thebiometric identification device comprises obtaining an image of each ofthe test-takers' iris using an iris scan camera of each of the testingassemblies and performing a biometric check on the identity of thetest-taker based on the obtained image of the iris.
 7. The method ofclaim 1, further comprising generating the sequence of the real displaysfor the respective one of the tests and fake displays so that the realdisplays appear at a set place within each of a plurality of consecutivegroups of a common number of displays.
 8. The method of claim 1, whereineach of the plurality of testing assemblies is positioned on a head ofthe respective one of the test-takers, the method further comprising:monitoring, using a camera of each of the testing assemblies, an eye ofthe test-taker using the respective one of the plurality of testingassemblies; determining whether the eye of the test-taker using therespective one of the testing assemblies changed from a previous time oris no longer present; and stopping display of the sequence of the realdisplays for the respective one of the tests and fake displays on thedisplay of the respective one of the testing assemblies when it isdetermined that the eye of the test-taker using the respective one ofthe plurality of testing assemblies has changed from the previous timeor is no longer present.
 9. The method of claim 1, further comprising:performing a biometric evaluation to determine an identity of each ofthe test-takers using a biometric identification device of a respectiveone of the plurality of testing assemblies; monitoring, using thebiometric identification device of each of the testing assemblies, abiometric feature of the test-taker using the respective one of theplurality of testing assemblies; determining, using a processor of eachof the testing assemblies, whether the biometric feature of thetest-taker using the respective one of the plurality of testingassemblies changed from a previous time; and stopping display of thesequence of the real displays for the respective one of the tests andfake displays on the display of the respective one of the plurality oftesting assemblies when it is determined that the biometric feature ofthe test-taker using the respective one of the plurality of testingassemblies has changed from the previous time.
 10. The method of claim1, further comprising generating the sequence of the real displays forthe respective one of the tests and fake displays so that the realdisplays appear randomly within each of a plurality of consecutivegroups of a common number of displays.
 11. The method of claim 1,further comprising creating the fake displays to be visually similar tothe real displays for each of the respective one of the tests.
 12. Themethod of claim 1, wherein the step of decrypting, at each of thetesting assemblies, the encrypted code to obtain the places of the realdisplays in the sequence of the real displays for the respective one ofthe tests and fake displays comprises utilizing a private decryption keyin an electronics package in a housing of each of the testing assembliesto decrypt the encrypted code.
 13. A method for taking a test,comprising: obtaining biometric data, using a biometric identificationdevice of a testing assembly at least partially in front of eyes of atest-taker, to determine an identity of the test-taker to take the testusing the testing assembly; receiving, at the testing assembly, the testfrom a source of tests based on the biometric data obtained by thebiometric identification device, the test comprising real displays;displaying a sequence of the real displays and fake displays on adisplay of the testing assembly visible by the test-taker; receiving, atthe testing assembly, an encrypted code providing, when decrypted,places of the real displays in the sequence of displays; decrypting theencrypted code to obtain the places of the real displays in the sequenceof displays; controlling a light valve assembly interposed between thedisplay and eyes of the test-taker based on the obtained places of thereal displays in the sequence of displays to cause the light valveassembly to assume, when a real display is being display, a first statein which the test-taker is able to view the display through the lightvalve assembly and thus the real display and assume, when a fake displayis being displayed, a second state in which the test-taker is preventedfrom viewing the display through the light valve assembly; receivingresponses from the test-taker to queries in the displayed real displaysvia at least one user interface of the testing assembly; and sendinganswers to the questions from the testing assembly to be graded, whereinthe grading is associated with the determined identity of the test-takerand a record of the test-taker with grades is created.
 14. The method ofclaim 13, wherein the step of decrypting the encrypted code to obtainthe places of the real displays in the sequence of displays comprisesproviding a private key unique to the testing assembly and using theprivate key to decrypt the encrypted code; the method furthercomprising: housing the private key in a memory component in a housingof the testing assembly; and encapsulating the housing in a chassisintrusion detector of the testing assembly that detects intrusion intothe housing and causes erasure of the private key upon detectingintrusion into the housing.
 15. The method of claim 13, furthercomprising: obtaining biometric data of the test-taker of the same typethat is obtained by the biometric identification device prior toadministration of an initial test; recording the obtained biometric datain a memory component for the test-taker; and then generating a signalindicating that the test-taker is ready to take the initial test, thestep of obtaining the biometric data to determine an identity of atest-taker to take the test using the testing assembly comprising:obtaining biometric data of the test-taker using the biometricidentification device prior to administration of a subsequent test afterthe initial test; ascertaining, based on the obtained biometric data,whether the test-taker using the testing assembly when taking theinitial test is the same as the test-taker using the testing assemblywhen taking the subsequent test; and when it is ascertained that thetest-taker using the testing assembly when taking the initial test isthe same as the test-taker using the testing assembly when taking thesubsequent test, generating a signal indicating that the test-taker isready to take the subsequent test to enable reception of the subsequenttest by the testing assembly.
 16. The method of claim 13, wherein thestep of obtaining the biometric data to determine an identity of atest-taker to take the test using the testing assembly comprisesobtaining an image of the test-taker's iris using an iris scan camera ofthe testing assembly and performing a biometric check on the identity ofthe test-taker based on the obtained image of the iris.
 17. The methodof claim 13, further comprising: monitoring, using a camera of thetesting assembly, an eye of the test-taker; determining whether the eyeof the test-taker changed from a previous time or is no longer present;and stopping display of the sequence of displays on the display of thetesting assembly when it is determined that the eye of the test-takerhas changed from the previous time or is no longer present.
 18. Themethod of claim 13, further comprising: monitoring, using the biometricidentification device of the testing assembly, a biometric feature ofthe test-taker; determining, using a processor of the testing assembly,whether the biometric feature of the test-taker changed from a previoustime; and stopping display of the sequence of displays on the display ofthe testing assembly when it is determined that the biometric feature ofthe test-taker has changed from the previous time.
 19. A method foradministering a test to a test-taker, comprising: directing the testfrom a source of tests to a testing assembly being used by thetest-taker, the test comprising real displays; displaying a sequence ofthe real displays and fake displays on a display of the testingassembly; directing, to the testing assembly, an encrypted codeproviding, when decrypted, places of the real displays in the sequenceof displays; decrypting, at the testing assembly, the encrypted code toobtain the places of the real displays in the sequence of displays;controlling a light valve assembly of the testing assembly interposedbetween the display and eyes of the test-taker based on the obtainedplaces of the real displays in the sequence of displays to cause thelight valve assembly to assume, when a real display is being displayed,a first state in which the test-taker is able to view the displaythrough the light valve assembly and thus the real display and assume,when a fake display is being displayed, a second state in which thetest-taker is prevented from viewing the display through the light valveassembly; and receiving responses from the test-taker to queries in thereal displays via at least one user interface associated with each ofthe testing assemblies; whereby by evaluating the received responsesfrom the test-taker, associating the evaluations with the determinedidentity of the test-taker, and grading the test, a record of thetest-taker with a test grade is created.
 20. The method of claim 19,wherein the step of decrypting, at the testing assembly, the encryptedcode to obtain the places of the real displays in the sequence ofdisplays comprises utilizing a private decryption key in an electronicspackage in a housing of the testing assembly to decrypt the encryptedcode, the method further comprising: encapsulating the housing in achassis intrusion detector of the testing assembly that detectsintrusion into the housing and causes erasure of the private key upondetecting intrusion into the housing.